The message isn't for the attackers but for the customers. Tim Cook sneezes and there's 50 different blog posts about his snot; what do you think would happen if an Apple developer site when down with a message that said, "There was a security breach!" and no additional context? Fox News would be running stories about how Russian hackers stole your grandmother's iTunes gift cards.

They played it safe by waiting until they actually knew what happened before releasing any information.